The Data::DisjointSet::Shared module creates a memory‑mapped backing file by opening it with open(path, O_RDWR|O_CREAT, 0666). Because the mode is 0666, the default umask of 022 results in a file that is world‑readable, and because the open call omits O_EXCL and O_NOFOLLOW a symlink can be planted at that path. An attacker who can write to the shared directory or create a symlink therefore can read or substitute the backing file. The result is that any local user can view or tamper with the IPC payloads stored in the segment, a violation of critical permission assignment (CWE‑732) and a form of path traversal or symlink attack (CWE‑59).

Any system that installs EGOR's Data::DisjointSet::Shared before version 0.02 is vulnerable. This includes typical Unix or Linux environments where Perl scripts using shared disjoint set data structures are executed. The issue arises when the module creates its backing file in a shared directory such as /tmp or /dev/shm, which is globally writable by all users. Consequently, all unprivileged users on the host can read or alter the data stored in the shared segment.

The CVSS score of 4.0 indicates a low severity and the EPSS score being below 1 % suggests that exploitation is unlikely in practice. The vulnerability is not listed in CISA’s KEV catalog. Nonetheless, because the vulnerability relies on local file system operations, a local attacker with the ability to create a file or symlink at the designated path can walk the pre‑creation race or seize control of the file. The exploit path is straightforward: create a symlink or pre‑create the target file in a world‑writable directory and then run the Perl application. The absence of O_EXCL and O_NOFOLLOW allows the attack to succeed without error.